Forum Discussion

oguzhansusam_25's avatar
oguzhansusam_25
Icon for Nimbostratus rankNimbostratus
Aug 09, 2018

how to send header parameter to remote syslog ?

Hi,

 

When http request blocked ASM profile I want see host parameter in request header on my SIEM solution. Because we have some web site on same virtual server so we dont see the blocked request come which web site on SIEM.

 

Thank you

 

application delivery
ASM Advanced WAF
  • Niels_van_Sluis's avatar
    Niels_van_Sluis
    Icon for MVP rankMVP
    Aug 09, 2018

    You could do something like this:

    when CLIENT_ACCEPTED {
   set hsl [HSL::open -proto UDP -pool syslog_server_pool]
}
when HTTP_REQUEST {
    Log HTTP host and request as local7.info; see RFC 3164 Section 4.1.1 - "PRI Part" for more info
   HSL::send $hsl "<190> [IP::local_addr] [HTTP::host] [HTTP::uri]\n"
}

    See: https://devcentral.f5.com/wiki/iRules.HSL__send.ashx